Every time you install an app from the Atlassian Marketplace or monday.com Marketplace, you’re placing a certain amount of trust in its creator. Will the app keep your data secure? Will updates break your workflows? How quickly will issues be fixed if something goes wrong?

These are the questions we constantly keep in mind. That’s why behind every release there is a Software Development Life Cycle (SDLC) designed to make our apps secure, reliable, and ready for change. Our SDLC ensures that every release is planned, tested, monitored, and continuously improved. Here’s how it works in detail.

Security Comes First 

From the moment an idea becomes a feature until long after it’s released, security is a priority embedded into everything we do. 

When we’re designing a solution, we look for potential risks early. While writing code, we follow secure coding standards, run automated code analysis, and check third-party libraries for known vulnerabilities. Before anything reaches production, it goes through security validation as part of our QA process.

We also believe that fresh eyes make software safer. Our apps take part in independent security programs like Cloud Fortified and Bug Bounty, where external security researchers regularly test our applications.

Our infrastructure is hosted on Amazon Web Services (AWS), a trusted cloud platform. Databases are encrypted using AES-256 (Advanced Encryption Standard with 256-bit encryption), an industry-standard encryption method. Access to production systems is strictly controlled, and reliable automated backups are performed regularly to ensure data can be recovered if necessary.

Basically, there isn’t a single moment when security is “done.” It’s something present in every stage of the development process.

Planning & Refinement: Where Quality Begins 

Every feature begins with refinement sessions where developers, QA engineers, and product owners work together to understand:

• business requirements
• user expectations
• security implications
• performance considerations
• potential technical risks

Having QA involved from the start helps us catch gaps or unclear requirements early. Together, we define acceptance criteria, think through edge cases, and make sure every requirement can be properly tested.

Because we build apps for Atlassian and monday.com, planning also means keeping up with changes on both platforms. We regularly review upcoming API and platform updates to understand whether they could affect our apps and adjust our plans if needed.

When deciding what to work on next, we follow a simple rule. Security, stability, and customer-reported issues always come first. After that, we focus on platform-related changes, followed by new features. This helps us keep our apps reliable while continuing to improve them.

Building Quality Into the Code 

Writing code is only part of the process. Before any change becomes part of the product, it goes through several checks to make sure it’s reliable, maintainable, and safe.

Every pull request is reviewed by another developer, and more complex changes may involve additional reviewers. Code isn’t merged until all review comments have been addressed and every automated quality check has passed.

We also rely on automated tools throughout development. Static code analysis helps us identify potential issues early, while tools like PMD, Sonar, ESLint, TypeScript, and Prettier help us maintain consistent code quality. We regularly scan third-party dependencies with Snyk to identify known security vulnerabilities and keep our libraries up to date.

Testing starts during development, not after it. Developers write unit and integration tests to verify individual components and how they work together. Depending on the feature, we also use functional and scenario-based tests to make sure new code behaves as expected without affecting existing functionality.

This combination of automated checks, peer reviews, and testing helps us catch issues early, when they’re easier to fix, and gives us confidence before changes move to the next stage of the development process.

Comprehensive Quality Assurance 

By the time a feature reaches QA, it has already gone through code reviews, automated checks, and developer testing. QA adds another layer of validation before the feature moves any closer to production.

We test new functionality, verify that existing features still work as expected, and check edge cases, integrations, and real-world user scenarios. The goal is to catch anything that could affect the customer experience before a release.

Our test cases are based on the agreed requirements and acceptance criteria. They’re reviewed by other team members, updated as the product evolves, and reused across future releases to keep testing consistent over time.

A Consistent Release Process

Releasing a new version is more than deploying code to production. Before an update reaches customers, we make sure it has gone through all required checks and is ready to be released safely.

Every release follows the same documented process. Changes are first verified in a controlled environment, release steps are automated wherever possible, and major releases are backed by database backups. This helps reduce the risk of human error and makes the release process predictable.

Once an update is available, we publish release notes so customers can see what’s changed and what to expect. Keeping users informed is just as important as delivering new functionality.

Following the same release process every time helps us deliver updates with confidence, whether it’s a small bug fix or a larger feature release.

Monitoring After Release

A release doesn’t mark the end of our work. It’s the point where we start watching how the application performs in a live environment.

We monitor application health, server logs, database performance, and frontend errors to spot potential issues as early as possible. Tools like Sentry, Pingdom, and the Forge Developer Console alert us if something unexpected happens, allowing the team to investigate quickly.

If an issue does occur, our priority is to understand its impact and resolve it as soon as possible. Depending on the situation, we may release a hotfix, share a temporary workaround, and keep customers informed through our public status page.

After the issue is resolved, we review what happened, identify the root cause, and look for ways to prevent similar problems in the future. Every incident is an opportunity to improve both our product and the way we build it.

Learning from Customer Feedback

We highly value our customers’ feedback. Every support request, bug report, and feature suggestion helps us understand how people use our products in their day-to-day work.

Our customer care team works closely with developers and QA to make sure feedback reaches the people who can act on it. Some requests turn into bug fixes, others lead to new features, and sometimes they highlight opportunities to make an existing workflow simpler or more reliable.

This feedback is an important part of how we plan future work. It helps us focus on improvements that have the biggest impact for our customers.

Building Trust, One Release at a Time

Most customers never see what happens before a new version of an app appears in the Marketplace. They don’t see the planning sessions, code reviews, testing, or monitoring that happen behind the scenes.

What they do notice is whether an app is reliable, secure, and continues to work as expected after every update.

That’s what our development process is designed to achieve. Every stage – from planning and development to testing, release, monitoring, and customer feedback – helps us reduce risk, respond to change, and keep improving our products.

We know that building software is never a finished job. As Atlassian and monday.com evolve, and as our customers’ needs change, our process evolves with them. Following the same principles every day helps us deliver applications our customers can rely on.